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Abstract. 

, Although quantum algorithms realizing an exponential time speed-up over 

^ . the best known classical algorithms exist, no quantum algorithm is known per- 

^^O ■ forming computation using less space resources than classical algorithms. In this 

' paper, we study, for the first time explicitly, space-bounded quantum algorithms 

' for computational problems where the input is given not as a whole, but bit by 

I bit. We show that there exist such problems that a quantum computer can solve 

, using exponentially less work space than a classical computer. More precisely, we 

\^ • introduce a very natural and simple model of a space-bounded quantum online 

' machine and prove an exponential separation of classical and quantum online 

space complexity, in the bounded-error setting and for a total language. The 
language we consider is inspired by a communication problem (the disjointness 
function) that Buhrman, Cleve and Wigderson used to show an almost quadratic 
separation of quantum and classical bounded-error communication complexity. 
P5 ' We prove that, in the framework of online space complexity, the separation be- 

' comes exponential. 



1 Introduction 

Space complexity studies the amount of work space necessary to solve computational 
problems. In particular, one of the most active research topics is sublinear space complexity, 
the study of computation where the amount of work space available is less than the size of the 
input. In this case, work space has to be separated from the input space. This is usually done 
by supposing that the input is written on a read-only memory and that an additional read- 
write work memory is available. Sublinear space complexity is thus practically meaningful 
in the case of computational devices for which the cost of work memory is prohibitive 
compared with the cost of (read-only) input memory. One of the main reasons why the 
study of quantum sublinear space complexity is of paramount importance is that quantum 
computers are precisely such kinds of devices. Indeed, defining quantum space complexity 
is not an easy matter but, intuitively, the input of the computation being classical, it is 
natural to consider that, even for a quantum computer, the input is stored on a classical 
memory. In this case, the quantum space complexity of a computational task corresponds 
directly to the amount of quantum memory necessary for the computation. Since, today, 
one of the main technological obstacles to the construction of a quantum computer seems 
to be the realization of quantum memory, studying what can be done with a small scale 
quantum memory is extremely important and this is precisely what we study in this paper. 
Another connected motivation for the study of quantum space complexity is the theoretical 
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and practical issue of understanding whether it is possible to design quantum algorithms 
that use less quantum work space than the classical work space needed by the best classical 
algorithms. 

Space complexity of quantum Turing machines has been studied by Watrous [23l [24] . He 
first defined a model of quantum Turing machines allowed to perform a very restricted kind 
of measurements during the computation |23j and proved the following rather surprising 
negative result: in the unbounded-error setting (the computation has to be correct with 
probability strictly greater than 1/2, but this probability can be arbitrary close to 1/2), this 
model of quantum computation is equivalent, as far as space complexity is considered, to 
classical probabilistic computation. Watrous then defined a far more general model of space- 
bounded quantum device [24j and showed that even this strong model is also equivalent, as 
far as unbounded-error space complexity is considered, to classical probabilistic computation. 
Using the result by Borodin, Cook and Pippenger [7] that states that any unbounded- 
error probabilistic computation can be simulated by a deterministic machine with at most 
a quadratic increase of space, this implies that any exact, bounded-error or unbounded- 
error quantum computation that uses s quantum space resource can be simulated by a 
deterministic classical computation using space. Thus the gap between space-bounded 
quantum and classical computation can at most be quadratic. 

In this paper we show that, when the input is given online, i.e., bit by bit, and not as 
a whole, the situation changes dramaticalljo: there are computational problems for which 
a quantum computer can use exponentially less space resources than a classical computer. 
This model of computation corresponds to the notion of streaming algorithms and is the 
model of choice for extremely long inputs that cannot be stored in memory, like data from 
large databases or from the Internet (we refer to [12] for a good survey of the active research 
field of classical streaming algorithms). 

To obtain our separation, we introduce a model of online quantum machine, very simple 
and weaker than Watrous 's model [24]. Informally, our quantum machine can be considered 
as a classical probabilistic Turing machine with an additional quantum register. The partic- 
ularity of this model is that the classical and quantum parts are completely separated, giving 
a very realistic model. Indeed, if a quantum computer can be built, it will be meaningless 
to ask it to perform tasks that can done efficiently using classical computation. 

Our main result is an exponential separation of quantum bounded-error online space 
complexity and classical bounded-error online space complexity for a total language. The 
language we consider is based on the following online computational problem, inspired by a 
well-known problem from communication complexity used by Buhrman, Cleve and Wigder- 
son [11]. Two binary strings of the same length, x — xi ■ ■ ■ x,n and y — yi • • -j/m, are 
repeatedly input, bit by bit: the computational device receives xi, then X2, up to Xm, then 
Hi up to Um and again xi . . . , the alternation being repeated about times. The problem 
is to decide whether there is an index i g {1, . . . , m} such that Xi = yi = 1. If the classical 
device can store the two strings in memory, the problem is trivial but, in the case where 
the length m of the string is extremely large and is far beyond the capacity of the memory, 
this approach is impossible. We show, using arguments from communication complexity, 
that, for a classical bounded-error online Turing machine, it is indeed impossible to solve 
this problem with noticeable probability if less than Q{^/m) memory is available. Then we 
show that, for a quantum bounded-error online machine, O(logm) memory (classical bits 
and quantum qubits) is sufficient to solve this problem with high probability, by simulating 
the protocol of [IT] . We use these results to give the first exponential separation of quantum 
and classical online space complexity, for a total language and in the bounded-error setting. 

^ In this paper, the term "onhne" refers to the concept of online Turing machines. We stress that this 
view of online computation is slightly different from the one usually adopted when studying competitive 
analysis of online algorithms. 
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To our knowledge, quantum online space complexity has never been explicitly studied 
before this worl|^. However, online space complexity is strongly connected with commu- 
nication complexity. In particular, any separation of quantum and classical one-way (only 
one-message sent) two-party communication complexity for a total function gives immedi- 
ately, under the assumption that the computational part of the quantum communication 
protocol can be done space-efficiently, a separation of quantum and classical online space 
complexity classes. From this observation, it is straightforward to show an exponential sep- 
aration of quantum nondeterministic and classical nondeterministic online space complexity 
from a result by de Wolf [26j . But nondeterminism is an unrealistic model whereas our 
main result holds for the most realistic model of bounded-error computation. Notice that 
some other separations are known for total functions in models different from the two-party 
setting, e.g. the so-called simultaneous message passing model |ilO^, but there is no direct 
way to convert them into a separation in the online space complexity setting. 

Separations of two-way (no restriction on the number of messages exchanged) quantum 
and classical communication complexity for total functions do not generally lead to a sepa- 
ration of quantum and classical online space complexity. However, the technique we use in 
this paper enables to obtain such a separation when the quantum protocol has a particular 
form and the computational mode is sufficiently powerful to solve the string equality prob- 
lem with small communication cost. These properties are satisfied by the quantum protocol 
involved in the separation of quantum and classical bounded-error communication complex- 
ity by Buhrman, Cleve and Wigderson [11], leading to our results. Actually this technique 
can also be used to show a quadratic separation of classical nondeterministic and quantum 
weakly nondeterministic online space complexity for a total language, using a result by Le 
Gall [ig. 

We stress the following point: although the separation of [11] is only (almost) quadratic, 
our separation in the framework of bounded-error online space complexity is exponential. 
Our result, even though relatively simple, is indeed rather surprising: the best separation 
known of quantum and classical bounded-error communication complexity for a total func- 
tion is quadratic [T] and, in the framework of query complexity, it has been shown that 
classical and quantum bounded-error query complexities of total functions are polynomially 
related We mention that an exponential separation for a partial function (a function 
with a promise on the inputs) in the setting of bounded-error one-way communication com- 
plexity has been recently presented by Gavinsky, Kempe, Kerenidis, Raz and de Wolf [12] . 
They used this separation to obtain an exponential separation of quantum and classical 
online space complexity as well, but for a partial function. In comparison, our separation 
holds for a total function. 

Our result shows that there exist computational online problems for which the space saving 
can be exponential over classical computers. From a practical point of view, this also shows 
that constructing a quantum computer with a small scale quantum memory is sufficient to 
solve online problems that a classical computer with a large scale memory cannot solve. 

Although the online computational problem we are considering in this paper is rather 
artificial, we hope that our work will be a first step in the direction of designing space- 
efficient quantum algorithms solving concrete problems for data streams. 

The organization of this paper is as follows. In Section |2l we recall definitions of online 
space complexity and present our model of quantum online space complexity. In Section 
|3]we present our result: an exponential separation of quantum and classical bounded-error 
online space complexity. 

^ But notice that, in the different context of finite automata, and not Turing machines, Ambainis and 
Freivalds have shown that quantum automata can recognize some languages using exponentially less states 
than any classical automaton [4j. 



3 



2 Online Space Complexity: Definitions 

2.1 Classical online Turing machines 

We refer to, for example, Balcazar, Diaz and Gabarro [5] for a presentation of the general 
model of (offline) Turing machines. Here, we explain the details of the model of online 
probabilistic Turing machines we consider in this paper and the notations we will use. 

An online, or one-way, probabilistic Turing machine, that we abbreviate as OPTM, is 
simply a probabilistic Turing machine with two tapes (the input tape and the work tape) 
whose input tape is one-way, i.e., the tape-head can move to the right but never moves back 
to the left. This means that the machine cannot go back to read the beginning of the input 
string and has to store in the work tape all the information about the input string it will 
need in the future. In the following, we will consider that the alphabet of both the input 
tape and the work tape is the ternary alphabet S = {0, 1, #}. 

The probability of acceptance of an OPTM M on an input w, denoted pj^i (w) , is defined as 
the probability, over all coin flips of the machine, that the input halts on an accepting state. 
There are two ways of rejecting: either by stopping in a non-accepting state or by never 
halting. Notice that, for bounded-error space complexity, the condition that the machine 
halts on each input and each coin flips a priori changes the computational power of the 
machine. The objective of this paper being to prove lower bounds on the space needed by 
classical machines, we consider the strongest model, where the machine is not required to 
halt on each input. 

The space used for the computation on an input w is the number of cells of the work 
tape used on the worst coin flips. We now define, for a function s : N ^ N, the class of 
space-bounded bounded-error online computation, denoted OBPSPACE{s). 

Definition 2.1 Let L he a language over the alphabet S — {0,1,^}. We say that L G 
OBPSPACE{s) if there exists an OPTM M such that, for each w G S* ; 

(i) if w €z L then Pm{w) > 2/3; 

(ii) if w ^ L then pm{w) < 1/3; 

(Hi) M uses at most s{\w\) space on the worst coin flips. 

The constants 2/3 and 1/3 are somewhat arbitrary, because amplification is possible (by 
running many computations in parallel) up to any constant without increasing the space 
complexity by more than a constant multiplicative factor. As usual, we will use notations of 
the form OBPSPACE{s{n)) instead of OBPSPACE{s). In this case, n always represents 
the input length. 

The configuration of an OPTM at a given step is the set of four elements consisting of the 
current control state, the current positions of the two tape-heads and the current content of 
the work tape. The following fact is an immediate consequence of this definition. 

Fact 2.2 Let M be an OPTM with tape alphabet S and set of control states Q such that, 
for each input w G T,* , M uses at most s{\w\) space on the worst coin flips. Then the 
total number of different configurations that can appear with positive probability during the 
computation by M on inputs of length n is at most 

ns(n)|I]|^(")|Q|. 

2.2 Quantum online space complexity 

We refer to the textbook by Nielsen and Chuang [20] for a good reference about quantum 
computation. 
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Designing a general model of quantum computation for the study of quantum space com- 
plexity is not an easy task. Aharonov, Kitaev and Nisan [3J have shown that the usual 
model of quantum Turing machines that allow measurements only at the end of the com- 
putation is equivalent, with respect to time- resources, to the most general view of quantum 
computation that includes measurements during the computation and thus is not unitary. 
However, their simulation techniques cannot be used to prove equivalence with respect to 
space-resources. Indeed, a direct simulation of a probabilistic computation by a quantum 
unitary machine need to remember all the results of the coin flips and it thus terribly in- 
efficient (a probabilistic computation using s work space can use a number of coin flips 
exponential in s and in the unitary quantum computation model there is no way of reusing 
the space!). To obtain a definition of quantum space complexity such that quantum classes 
include classical probabilistic classes, it thus seems to be necessary to allow measurements 
during the computation. 

The input being a classical string, it is natural to consider that the input tape is clas- 
sical. Watrous [24j has defined such a model of "hybrid" quantum Turing machine, where 
measurements are allowed during the computation and their outcomes control the computa- 
tion. Actually, Watrous 's definition is very general and the interaction between the classical 
part and the quantum part of this machine is rather complex. In this paper, we consider 
a simpler, and weaker, version of quantum hybrid machines, but still powerful enough to 
show separations of classical and quantum space complexity in the context of online compu- 
tation (as we want to show separations of classical and quantum computation, the weaker 
the quantum model is, the better). Informally, our machine can be considered as a classical 
probabilistic Turing machine that has access to a quantum register, the initial state of this 
register being |0) • • • |0). Both the work space of the classical machine and the number of 
qubits of the quantum register that have been used during the computation are considered 
when defining the global space complexity. This informal description is actually sufficient to 
understand the results of this paper: our upper bound fTheorem l3.4p is proved by presenting 
a space-efficient online quantum algorithm, and details about the model of the quantum on- 
line machine do not really matter. Nevertheless, for completeness, we now describe carefully 
the model. 

Denote by the set of gates {G'o,Gi,G2}, universal for approximate quantum compu- 
tation, where Gq = H is the Hadamard gate, Gi = T the 7r/8 gate and G2 = CNOT the 
2-qubits CNOT gate. Let S be a finite alphabet and s be a function constructible using 
logarithm space such that f2(logn) < s(n) < n. We are interested in sublinear complexity 
classes and, thus, we suppose that the input w S S* (a classical string) is given as input 
to a classical OPTM. Here the OPTM is seen computing a function: there is a third one- 
way write-only tape, on which the machine writes its output. Only the read-write work 
tape is taken in consideration in the definition of the space complexity of the OPTM. We 
further suppose that s(|w|) qubits are available, initialized to the state |0)'^^'^l"'l-'. These 
qubits are supposed to be ordered, each qubit labeled by an integer in {0, . . . , 5(1^1) — 1}. 
Given two distinct integers a and 6 in {0, ... , s{\w\) — 1}, and any integer i in {0, . . . , 2}, 
we denote by g'"'^' the gate Gi G 5^ applied to the qubits number a and b (or only to the 
qubit number a if Gi is a one-qubit gate). We use the convention that, if a = 6, then G'f'^^ 
represents the identity gate. We now define formally the quantum online one-sided-error 
and bounded-error space complexity classes that we denote respectively OQRS P AC E{s) 
and OQBPSPACE{s). 

Definition 2.3 Let L he a language over the alphabet E = {0,1, #}. We say that L E 
OQRSPACE{s) [resp. L e OQBPSPAGE{a)] if there exists an OPTM M such that, for 
each u) e E* , the following holds: 

1. Whatever the outcomes of the coin flips are, M halts after at most 2'*(l™l) computational 
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steps and uses at most s{\w\) space. 



2. Whatever the outcomes of the coin flips are, the contents of the output tape when M 
halts is of the form 

ai#foi#ci#---#a,.#5,#c,, (1) 
for some integers r > 1 and Oi, bi G {0, . . . , s(|w|) — 1}, Ci S {0, . . . , 2} {I < i < r). 

3. If w Cz L, then the output (Qp satisfies, with probability at least 1/4 [resp. at least 
1^/2/3/, the following condition: the outcome of the measurement of the first qubit of 
the state ci"'''^'-! • • • G't"'''''! (|0)®"(l'"l)) is 1 with probability at least 1/4 [resp. at least 

4. If w ^ L, then the output (QJ) satisfies, with probability 1 [resp. at least ■\/2/3y, 
the following condition: the outcome of the measurement of the first qubit of 
^K,6,] ^ , ,Q[alM]^^^®s(\w\)~^ Q y,-^^ probability 1 [resp. at least ^flJZ]. 

This definition corresponds to the fohowing reaUstic model of quantum hybrid device, where 
the computation consists in two stages. First, the machine M is used on the input string, 
giving a description of a quantum circuit (^["'■•'''■l . . -G^c^'^^^ . Then, this circuit is apphed 
to the quantum state [O)®^'-!"'!'' and the first qubit of the resulting state is measured in 
the computational basis {|0), |1)}. The input string is accepted if the outcome is 1, and 
rejected if the outcome is 0. For a language L in the class OQRSPACE{s), if w G L, 
then the probability that the string is accepted is at least 1/16 (this value is somewhat 
arbitrary and can be increased by performing amplitude amplification on both the classical 
and the quantum parts of the online machine); if w ^ L, then the probability that the 
string is rejected is 1. For a language L in the class OQBPSPACE{s), ii w £ L, then the 
probability that the string is accepted is at least 2/3; if w ^ L, then the probability that 
the string is rejected is 2/3. Notice that in our definition, we allow the same classical space 
and quantum space s(|w|) for the computation. 

Practically, there is no need to store all the output of the OPTM: the gates can be applied 
as soon as they are output. From condition 1., the total number of gates applied is no more 
than 2'*(l'"l). Moreover, with our definition, the machine always halts and measurement of 
the quantum register is allowed only once, at the end of the computation. This is a weak 
model compared with the general definition of quantum machines proposed by Watrous |24| . 
However, we will show that such a model is still able to present an exponential save of space 
over the classical model. 

Finally, we denote OQRL = [j^^^OQRSPACE (clogn) and OQBPL = 
U,>o OQBPSPACE (clogn). 

3 Our Exponential Separation 

In this section, we present the exponential separation of classical bounded-error and quan- 
tum bounded-error online space complexity. Actually, we prove a stronger result: an ex- 
ponential separation of classical bounded-error and quantum one-sided-error online space 
complexity. 

3.1 The disjointness problem 

We first shortly recall basic definitions of classical communication complexity. We refer, 
for example, to Kushilevitz and Nisan [17] for further details. Given a set of pairs of strings 
X xY, where X C {0,1}* and Y C {0,1}*, and a function f : X x Y {0,1} , the 
communication problem associated to / is the following: Alice has an input x £ X, Bob an 
input y gY and their goal is to compute the value f{x,y). We suppose that Alice and Bob 
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have unlimited computation power. In a randomized communication protocol, each player 
can flip (private) coins and send messages according to the coin flip outcomes. We say that a 
randomized protocol is a bounded-error protocol for / if, for each {x,y) E X xY the protocol 
outputs f{x,y) with probability at least 2/3. The communication complexity of a bounded- 
error protocol P that computes correctly /, denoted R2/3{P, f), is the maximum, over all 
the inputs {x,y), of the number of bits exchanged between Alice and Bob on this input 
on the worst coin flips. The bounded-error communication complexity of the function /, 
denoted R2/3if), is the minimum, over all the bounded-error protocols P that compute /, of 
i?2/3(P, /). Quantum communication complexity is defined similarly, the only modification 
being that Alice and Bob can send quantum messages. We refer to [9l [161 El] for good 
surveys of quantum communication complexity. 

Now consider the following communication complexity problem, known as Disjointness. 

Disjointness (DISJ„, n > 1) 

Alice's input: a string x — xq ■ ■ ■ Xn-i in {0, 1}" 
Bob's input: a string y — yo ■ ■ ■ yn-i in {0, 1}" 
output: DISJn{x,y) = Aie{o,...,n-i}ii^^i) ^ hVi)) 

In other words, DISJn{x, y) = 1 if and only if there is no index i G {0, . . . , n — 1} such that 
Xi = yi = 1. Buhrman, Cleve and Wigderson [llj have studied the quantum communication 
complexity of DISJn and shown the following result. 

Theorem 3.1 ( [Tlj ) The quantum bounded- error communication complexity of the func- 
tion DISJn is 0{^/ri log n). 

Moreover, using the following well-known result of classical communication complexity, they 
notice that this leads to an almost quadratic separation of quantum and classical bounded- 
error communication complexity. 

Theorem 3.2 ([HHHl) R^/^iiDISJn) = ^{n). 

Notice that the result of Theorem 13.11 has been improved by H0yer and de Wolf and 
further by Aaronson and Ambainis 1^, who gave a protocol using 0{^Jn) quantum commu- 
nication, which is optimal from a result by Razborov |22j . This leads to a perfectly quadratic 
separation, but we will not use these results in this paper. 

The quantum protocol of [llj realizing the upper bound is based on Grover's algorithm 
[13j . or more precisely its generalization proposed by Boyer, Brassard, H0yer and Tapp 
[5], that deals with the case where the number of solutions is unknown. It uses, on the 
worst input and on the worst coin flips, at most \\/ri\ communication rounds, each message 
consisting of 0(log n) qubits. An important property of this protocol is that Alice and Bob 
have only to keep in memory the last message received in order to compute the next message. 
This is the key observation leading to our result. 

The total language we are considering is the following. 

Definition 3.3 Let Ldisj be the following language over the alphabet {0, 1,#}. 

= { l'#(x#y#x#)2''| fc>l; x,y e{0, l}^'' and ^/5J22. (x, y) = 1 } 

where (x=i^y=i^X7^)^ means 2^ times the concatenation o/x#y#x#. 

The idea behind the above deflnition is that, as \/2^ = 2^ rounds are needed in the worst 
case for the quantum protocol computing DISJ2^k presented in [llj . we concatenate the 
inputs 2*^ times. 
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3.2 Quantum upper bound 

We now show that the language Ljjisj can be recognized using logarithm space by a 
bounded-error quantum online machine. Actually, we first give the following stronger the- 
orem that states that the complement of the language Lujsj, denoted Lois J and defined 
as Luis J — {0, 1, 4f\*\L'Disj, can be recognized using logarithm space by a one-sided-error 
quantum online machine. 

Theorem 3.4 Ldisj £ OQRL. 

This theorem implies our main upper bound. 

Corollary 3.5 Ldisj e OQBPL. 

Proof of Theorem 3.4. We describe a quantum online algorithm using logarithmic space 
recognizing Ldisj., such that on an input string w G {0, !,#}*: (1) if w G Ldisj then 
the algorithm accepts w with probability 1; (2) if w ^ Ldisj then the algorithm rejects w 
with probability at least 1/4. It is straightforward to convert this algorithm into an OPTM 
accepting the language Ldisj and satisfying the conditions of Definition 12.31 

The most difficult case is when the input satisfies the following three conditions (if the 
input does not satisfy one of them, it should be rejected). 

(i) The input string is of the form 

l^-#x(i)#y(i)#z(i)# . . . #x(-^)#y(-^)#z(^'')# 

where fc > 1, x*'), y('\ z*') £ {0,1}^'' are strings in {0,1}^'' for all i £ {1,...,2'=}; 
and 

(u) x(i) = z(i) = x(2) = z(2) = . . . = x(2'') = z^^"); and 

(ni) yW=y(^) = --- = y(^'^+^). 
We will present three procedures used to construct our quantum algorithm: 

• a deterministic classical online procedure Ai that outputs, using logarithm space, 1 if 
condition (i) holds and outputs if condition (i) does not hold. 

• a one-sided-error classical online procedure A2 that outputs, using logarithm space, 
when the input satisfies condition (i): 

— 1 with probability 1 if the input satisfies both (ii) and (iii); and 

— with probability at least 1/4 if the input does not satisfies (ii) or (iii). 

• a one-sided-error quantum online procedure A3 that outputs, using logarithm (classical 
and quantum) space, when the input satisfies the three conditions (i), (ii) and (iii): 

— 1 with probability 1 if the input is in Ldisj\ and 

— with probability at least 1/4 if the input is not in Ldisj- 

The global quantum algorithm runs in parallel the three procedures Ai, A2 and A3 and 
recognizes the input according to the following rule: if Ai outputs 0, reject; if Ai outputs 
1 and A2 outputs 0, reject; if both Ai and A2 output 1, then accept if A3 outputs 1, reject 
if A3 outputs 0. The global algorithm itself has the claimed success probability from the 
assumptions on Ai, A2 and A3: if the input is in Ldisj , the input accepted with probability 
1; else the input is rejected with probability at least 1/4. This algorithm uses logarithm 
classical and quantum space. 
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The procedure Ai can be easily implemented. The rest of this proof consists in describing 
the two procedures A2 and A3. 

Procedure A2 

The procedure A2 uses a well-known one-sided-error communication complexity protocol for 
string non-equality 17]. More precisely, for any w — {wq, . . . ,W22k_i) G {0,1}^ , let us 
consider the following polynomial in X. 

Fw(X) = w,X' modp, 

i=0 

where p is an arbitrary prime such that 2""^ < p < 2""^+^. Notice that such a prime is 
guaranteed to exist. Although more efficient techniques exist, the naive strategy consisting 
in trying all the numbers between 2'*'^ and 2^*^+^ is sufficient in our case. The procedure A2 
takes a random integer t in {0, . . . ,p — 1} and does the following while reading its input. 

• For i = 1 to 2''', compute F-^(i) (t), F^(i) (t) and check whether F^ii) (t) — F^m [t). 

• For i = 1 to 2^^ — 1, compute F^(i){t), Fy(;}{t), F^(i+i){t) and Fy(i+i){t) and check 
whether ^^(i) (t) = i^^c+i) (0 and Fy(i) {t) = FyC.+i) (t). 

The procedure outputs 1 if all the above tests succeed and outputs if at least one of the 
tests fails, and uses 0{k) memory bits On an input satisfying condition (i), if both (ii) and 
(iii) holds, then all the tests succeed with probability 1; if (ii) or (iii) does not hold, then it 
can be shown (see for example [17 ) that there is at least one test that cannot succeed with 
probability (on the choice of t) greater than 1/2^*^, and thus the procedure outputs with 
probability at least 1 — 1/2^*^. 

Procedure A3 

We now present the procedure A3 that decides, when the three conditions (i), (ii) and (iii) 
hold, whether the input string is in Ldisj or not. Notice that, in this case, the string 
is in Ljjisj if and only if Z)/S'J22fc (x^-'-^ y^-"-') = 1. The idea of procedure A3 is simply 
to simulate the communication protocol of Buhrman, Cleve and Wigdcrson |11| . We now 
carefully explain this simulation. 

We first define states and operators that are used by the procedure. Let \Lpk) be the state 

Next, define a unitary transformation and, for any string x G {0, 1}^ , two unitary 
transformations and Wx as follows. 




-\i)\h)\l) if i 7^0 
\i)\h)\l) ifi = 



V^:\i)\h)\l) ^ \i)\h(Bx,)\l) 
W^■.\^)\h)\l) ^ {-ly^^^^\^)\h)\l) 

for any i e {0, . . . , 2^'= - 1} and h, I e {0, 1}. Furthermore, define Uk = i?®^*^ (g) /i (g) h, 
where H is the Hadamard gate and Ii the one-qubit identity operator. Finally, for any 
string x € {0, 1}^ , we denote by _Rx the following unitary transformation. 

i?x : \t)\h)\l) ^ \t)\h)\l®{hAx,)), 

for aU i e {0, . . . , 22'=^ - 1} and h, I e {0, 1}. 
We are now ready to present procedure A3. 
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1. \lp) ^ \ipk)- 

2. Take an integer j chosen at random according to the uniform distribution over 
{0,...,2'^--l}. 

3. For I from 1 to j, do \^) ^ C/fc^fct/fc^w VKyO, V^w |(^). 

4. ^ i?yu+l)^4.(j+l)|¥'>• 
5. Measure the last qubit of \lp). Let h be the outcome. Then output (1 — b). 

The application of the gates Uk, Sk, , Wy(i), and i?y(i) can be done easily while 
reading the inputs x^'-', y^'-* and z^'-* (i.e., a quantum circuit implementing them can be 
computed using only 0{k) classical work space, as required by Definition 12. 3[) . From the 
equality 

E «^N)io)io> - E «.(-ir^^i^)io)io), 

i=0 J i=0 

we see that each application of the loop 3 corresponds to one iteration of Grover's algorithm. 
The state at the end of step 4 will be 

2^*^-1 

E mO)\^^^y^) 
i=0 

for some amplitudes /3i, and corresponds to to the state obtained after j iterations of Grover's 
algorithm. If the value DISJ22k (x^-'-^ y*^-*-^) is 1, then measuring the last register gives with 
probability 1. Then the procedure outputs 1 with probability 1. Otherwise denote by t the 
number of coordinates such that Xi /\ yi = 1. li t = 2^*^, then the procedure always outputs 
1 so let us suppose that < t < 2"^^. Denote by 9 the angle such that sin^ 6* = 1/2"^^, 
with < < 7r/2. The analysis by Boyer, Brassard, H0yer and Tapp ^ shows that the 
probability of measuring 1 (and thus outputting 0) is 

1 sin(4 • 2^9) 1 

2 ^ 4-2fesin(26l) " 4' 

Thus the procedure ^3 outputs, when the input satisfies condition (i), (ii) and (iii), 1 with 
probability 1 if the input is in Ljjisj and outputs with probability at least 1/4 if the input 
is not in Ldisj- D 

3.3 Classical lower bound 

We now show that any classical OPTM recognizing L]jjgj with bounded-error has to use 
f2(n^/'^) work space, where n is the input length. 

Theorem 3.6 There exists a constant ci > such that 

Ldisj i OBPSPACE{cin^^^). 

Proof. Our proof is inspired by an argument by Ablayev Consider an OPTM M 
recognizing the language Ldisj with bounded-error. Suppose, without loss of generality, 
that M does not halt before having read all the input. 

We show how to convert the computation of M on inputs of the form 

l'#(x#y#x#)2'= with X, y e {0, 1}2" (2) 
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into a communication protocol that computes DISJ22k . Let x be Alice's input and y Bob's 
input. Given two configurations Ci and C2 of M, we write Ci C2 if the configuration C2 
is reachable from Ci on the word w with positive probability, with the additional condition 
that the last computational step before reaching C2 includes a move of the head of the input 
tape to the right of the last character of w (i.e., w has been completely read and the next 
character on its right is for the first time scanned) . Denote by C^°-' the initial configuration 
of M. 

Alice and Bob use the following protocol to compute the value DISJ22k{x,y). 

1. For i from 1 to 3 • 2'^' — 1, do the following (if the protocol has not been interrupted): 
Step number i: Alice's turn if i ^ 2 mod 3, Bob's turn else. 

The player computes all Cj such that C^'^^-* ^ Cj and their probabilities pj, where 

( l'=#x# if i = 1 
w = < xjf if i 7^ 1 and i ^ 2 mod 3 
[ y# if i 7^ 1 and i = 2 mod 3 

The player sends a message consisting of the configuration Cj with probability pj . In 
this case, denote by C^*^ the configuration sent. With probability 1 — X^jPj' the player 
stops the protocol and outputs (this corresponds to the case of infinite work of the 
machine). Notice that if i = mod 3 (Alice's turn), Alice being the next player, she 
does not really need to send the configuration. For the simplicity of the analysis, we 
will suppose that even in this case Alice sends a message (to herself). 

2. Alice computes the probability p that the machine halts on an accepting configuration 
from the configuration C^'^'^ on the input xjf. She outputs 1 with probability p 
and outputs with probability 1 — p. 

The condition that M recognizes Ldisj with bounded error implies that the above pro- 
tocol is a correct bounded-error communication protocol for DISJ22k . Let '^l^^ be the set 
of configurations that are sent with positive probability at step i for at least one input of 
the form ([2]). The number of bits exchanged by the protocol is less than 

3-2'=-l 

1=1 

This implies that there exists necessarily an integer jq G {1, . . . , 3 • 2'^ — !} such that 

3-2^ — 1 
i—l 

From Theorem [321 the number of bits exchanged by the protocol is necessary f2(2^'^). Thus 
logl'^fc^'"^! is at least n{2'^''/{3 ■ 2^ - 1)) = f7(2'=). From Fact O the space necessarily for 
M is thus 17(2'=) = 17(ni/3)^ where n = is the size of the inputs of the form □ 

This lower bound is essentially tight, as shown in the next proposition. 

Proposition 3.7 There exists a constant C2 such that L^isj G OBPSPACE{c2n^^^) . 

Proof. Suppose that the input is l'=#(x#y#x#)^'' with x, y e {0, 1}^^''. The other cases 
can be dealt with by using the same classical techniques as in the algorithm of Theorem 
13.41 Now, we decompose x into 2'' blocks of 2'^ bits denoted [x]i, . . . , [x]2k, and decompose 
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y similarly. The OPTM checks successively the value of DISJ2h{[x]i, [y]i), for i from 1 to 
2*^, using the trivial procedure consisting of keeping all the bits of the block [x]i in memory 
before matching them with the bits of [y]i. This uses 0(2*^) = 0(n^/^) space, where n is 
the input size. □ 
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